topic IPS Regex for Boolean "AND" in Network Security

IPS Regex for Boolean "AND"

ganesh.kumar — Sun, 10 Mar 2019 12:39:25 GMT

Hi,

anyone know the regex string for Boolean "AND" operator. I came to know OR operator got string "|". But unable to find string for AND operator.

any help would be appreciated.

IPS Regex for Boolean "AND"

a.matahen — Tue, 17 Apr 2012 08:02:16 GMT

Hello Ganesh,

Are you trying to configure more than one action for a signature?

You can do that using the same operator, but with no spaces, the command should be:

event-action produce-alert|deny-packet-inline

make sure that you write "deny-packet-inline" not any abbriviation like deny-p

HTH

Ahmad

IPS Regex for Boolean "AND"

ganesh.kumar — Tue, 17 Apr 2012 17:16:46 GMT

Hi,

i am looking a option to use Regex. For example color and Green. I know multi-string can do this. But looking option to use in same line like we use OR (I) operator in Regex.

IPS Regex for Boolean "AND"

rupadras — Thu, 19 Apr 2012 21:28:53 GMT

Hi Ganesh,

Say, in your example, if the strings Color and Green are separated by AAAA, you can write a regex as "ColorAAAAGreen".

If you are not sure what characters can be between Color and Green, you can have a regex like "Color[\x00-\xff]*Green". This will fire if you see Color followed by Green in the traffic stream. But this includes a wildcard and could be memory-intensive. multistring engine would be better in this case.

So depending on the traffic you are matching, you can hardcode some strings in the regex and get the AND functionality.

HTH,

Radhika

IPS Regex for Boolean "AND"

ganesh.kumar — Tue, 01 May 2012 16:45:36 GMT

Hi Rupadras,

Thanks for the reply. Your answer worked me perfectly.